CVE-2026-4663 | iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Published: 2026-05-12 Last update: 2026-05-18 Assigner: [email protected] Source: [email protected]

Conclusion & alert: This CVE is rejected; it is not tracked as an active vulnerability. Mandatory action: Do not treat as an active exposure for patching queues—follow the CVE record status and authoritative vendor or program statements only.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-4663

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-12 0.06%

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-4663

CVSS metrics for this CVE.

No CVSS data in dataset for this CVE.

Weakness enumeration for CVE-2026-4663

GitHub Security Advisory for CVE-2026-4663

GHSA-9v2v-8mq8-p8ff · Severity: medium — The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions...

Affected software / configurations for CVE-2026-4663

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-4663

URL Tags
No references in dataset.
cvelogic Threat Intelligence